jail: don't make mount source read-only

From mount(2):
Specifying mountflags as:
  MS_REMOUNT | MS_BIND | MS_RDONLY
will make access through this mountpoint read-only, without affecting
other mount points.
Hence use MS_BIND when remounting container rootfs read-only.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

diff --git a/jail/jail.c b/jail/jail.c
index e8abd8a8d3bf7002aa038d64b968108182bc005b..aa6288edaf02f5946d46fe31d7e783f2e8979c4f 100644 (file)
--- a/jail/jail.c
+++ b/jail/jail.c
@@ -533,7 +533,7 @@ static int build_jail_fs(void)
                mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, 0);
        }
        if (opts.ronly)
-               mount(NULL, "/", NULL, MS_RDONLY | MS_REMOUNT, 0);
+               mount(NULL, "/", NULL, MS_REMOUNT | MS_BIND | MS_RDONLY, 0);
 
        return 0;
 }